Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

Summary: Cisco reported that three threat clusters tied to ransomware and state-sponsored attacks are exploiting two patched Secure Firewall Management Center vulnerabilities: CVE-2026-20079, a CVSS 10.0 authentication bypass in the FMC web interface that lets an unauthenticated remote attacker run script files and gain root access, and CVE-2026-20316, a CVSS 5.3 flaw allowing login with a low-privilege account to reach sensitive data and pair with other FMC flaws for privilege escalation. CISA added CVE-2026-20079 to its KEV catalog with a September 12, 2026 patch deadline for FCEB agencies, after adding CVE-2026-20316 in late July 2026, and Cisco said it will ship a broader hardening release next week.
What's compelling: A CVSS 10.0 authentication bypass on the appliance that manages your firewalls is a direct path to root, and Cisco attributes its exploitation to both crimeware and state-sponsored actors - meaning the same entry point serves ransomware crews and espionage groups alike.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-20079 CVE-2026-20316
Related: Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data Cyber Risks ·
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities Cyber Risks ·
CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Sep 09, 2026